#aws#AWS#DevOpsCommunity
AWS Identity and Access Management (IAM) is a web service that helps you securely control access to AWS resources. You use IAM to control who is authenticated and authorized to use resources.
May 8, 2022 • 6 tweets • 2 min read
Facing problem in making your own recon methodology
#bugbounty#bugbountytip#bugbountytips
First thing to test for an SQL injection is to try to break the query,with the intention of getting the syntax of how SQL is getting input at the backend.This technique works in UNION/Error based SQL Injections,where we force the backend database to throw an error.
Note:I m assuming that you have cleared your basics
#bugbounty#bugbountytip#bugbountytips
Start with learning how to use Burpsuite basics, there are many tutorials available on internet which you can refer. Why it is important?because it is important 🤪
Now you can start @PortSwigger Academy. They have a learning path you can follow that or you can follow owasp list
1-Ensure multi-factor authentication (MFA) is enabled for all IAM users that have a console password
2-Ensure credentials unused for 90 days or greater are disabled
3-Ensure access keys are rotated every 90 days or less
4-Ensure IAM password policy requires at least one uppercase letter
5-Ensure IAM password policy requires at least one lowercase letter
6-Ensure IAM password policy requires at least one symbol
Nov 5, 2021 • 5 tweets • 1 min read
If an LFI vulnerability exists, look for these files:
1-Linux system and user files:
/etc/passwd
/etc/shadow
/etc/issue
/etc/group
/etc/hostname
/home/user/
/home/user/.ssh
/home/user/bash_history
1-Identify Security Requirements
-Define and Categorize Assets in AWS
-Create Classifications for Data and Applications
2-Deploy Solutions Designed to Solve Cloud Security Challenges
-Manage Cloud Access: Limiting
-Use Cloud-Native Security Solutions
-Protect All Your Perimeters and Segment Everything
-Maintain a Consistent Security Posture Throughout AWS Deployments
Sep 28, 2021 • 13 tweets • 3 min read
File Upload Restriction Bypass Checklist
1-Try various file extensions-Try different versions of the file extensions, for example php3, .php4, .php5, phtml for PHP scripts, asp,aspx
#bugbounty#bugbountytip#bugbountytips
2-Append an extra file extension-If the application is not properly validating for the file extension, this can be exploited by appending another extension, for example from script.php to script.php.gif or script.gif.php
